Egress Gateway on Kubernetes
Validate the platform-supplied Egress Gateway deployment on Kubernetes with the issued image, configuration, ingress, and operations plan.
For platform teams deploying the platform-supplied Egress Gateway into Kubernetes. Egress Gateway is a shared gateway for AI clients, so a client connecting to an existing gateway does not need a local Defender installation.
AI client -> Egress Gateway -> AI provider
Ask your platform team for the exact client URL and credential issued for your organization. See Connect a client to Gateway for client setup.
Before you begin
Required
- Versioned image and registry access
Obtain the image and registry pull instructions supplied by Chaos Labs and your platform owner.
- Approved deployment configuration
Use your organization's supplied manifest, Helm values or equivalent configuration.
- Client endpoint
Obtain the exact Gateway endpoint and ingress path convention for clients.
- Connectivity and TLS policy
Obtain the control-plane and ingestion endpoints, network requirements, TLS policy and network boundaries.
- Operating instructions
Obtain health checks and rollout, scaling, upgrade and rollback instructions.
- Test identity and credential
Obtain a test user and the issued credential needed to verify forwarding and capture attribution.
Organization-managed deployment
Deploy with Chaos Labs and your platform team using the versioned configuration, apply or upgrade commands, health checks, and rollback procedure supplied for your organization.
Validate with the platform owner
After the platform owner completes the approved deployment procedure, verify the following acceptance criteria together:
- The Deployment and its platform-defined health checks are available.
- The client network can reach the issued gateway endpoint through the supplied ingress path and TLS configuration.
- Network policy, firewall, DNS, and TLS rules allow the required gateway, provider, control-plane, and ingestion connections.
- A test user can configure an AI client with the issued gateway endpoint and credential.
- A test request receives a provider response.
- The matching activity appears under the test user in the relevant user profile in Cortex Atlas.
A provider response verifies that the request reached the provider. Check the matching Cortex activity separately to confirm that it was captured and associated with the test user. Complete both checks before expanding the deployment.
Operate the gateway
Use the platform-provided procedures for monitoring, scaling, upgrades, and rollback. Monitor the health signals, restarts, request failures, latency, resource saturation, and outbound connectivity defined for the supplied deployment. If forwarding works but activity is missing, verify the supplied ingestion configuration and that intermediaries preserve the required client authentication headers.